98,356 new CVEs in a year, up 109%.313 newly listed as exploited, up 24%.
Nov 2025 – Oct 2026 against the twelve months before. CVE counts measure disclosure, not attacks, and the exploited list is a lower bound.
| CVEs published, all time | 405,853 |
| with a usable publication date, plotted below | 405,755 |
| Published in the last 12 months | 98,356 |
| the 12 months before | 47,125 |
| Published per day, last 90 days | 515 |
| the 90 days before | 285 |
| In KEV, all time | 1,779 |
| Added to KEV in the last 12 months | 313 |
| the 12 months before | 252 |
What is counted
| Term | Meaning | Here |
|---|---|---|
| Finding | A reported possible vulnerability, before triage. | Not counted |
| Validated vulnerability | A finding the supplier has confirmed. | Not counted |
| A public ID for a disclosed vulnerability, issued by a . Undisclosed flaws rarely get one.5 | 405,853 | |
| Exploitability | Whether an exploit is feasible. and estimate it; neither observes it. | Estimated only |
| Documented exploitation | Published evidence of use against a real system. | Through KEV |
| CISA's Known Exploited Vulnerabilities list. An entry needs a CVE, evidence of exploitation and a fix.2 | 1,779 |
These are separate sets, not stages of one process: 62 KEV entries were added before their CVE record was published.
Publication
98,356 CVEs published in , 2.1 times as many as in .
91.0% carry an ID reserved the same year, so the rise is not a backlog of old IDs being published. Drag across the chart to choose dates.
515 CVEs a day over the last , +80.6% on the 90 days before.
The growth rate itself changed by +39.0 percentage points. “Accelerating” is used only when both rose. It describes the series, not a cause.
Accelerating +80.6% on the previous window
GitHub_M added the most: +10,397 of the +51,231 change from to (20.3%).
The assigner is the organization that issued the ID, not necessarily the vendor of the affected product. 412 assigners published in 2026, against 363 in 2025. The Linux kernel's CVE team assigns an ID to “any bugfix that they identify”.6 Press × to leave an assigner out of every figure on the page.
Nov 2024 – Oct 2025 → Nov 2025 – Oct 2026: 47,125 → 98,356
24.2% of all dated CVEs were published in ; half of the catalog was published after 20 May 2023.
The whole catalog in publication order. Each year's width is its share of all records.
Documented exploitation
Red = in KEVKEV is the only exploitation evidence used here.2 A listing means exploitation was documented at least once, not how often or whether it continues.
- An entry requires a CVE and a fix, so flaws missing either cannot be listed.
- It leans toward large vendors: Microsoft accounts for 391 of 1,779 entries.
- Entries are dated when CISA adds them, not when attacks began. Absence from KEV does not mean a flaw was never exploited.
In Nov 2025 – Oct 2026: 98,356 CVEs published, 313 added to KEV. The 12 months before: 47,125 and 252.
The two rows use separate scales. Because KEV lags and undercounts, it cannot show whether exploitation kept pace with publication.
197 of 48,150 CVEs published in are in KEV today: 1 in 244.
| 2022: 24,999 CVEs | 131 in KEV · 0.52% |
| 2023: 28,847 CVEs | 166 in KEV · 0.58% |
| 2024: 39,924 CVEs | 161 in KEV · 0.40% |
| 2025: 48,150 CVEs | 197 in KEV · 0.41% |
| 2026 so far: 96,878 CVEs | 217 in KEV · 0.22% |
Recent years look lower partly because listings take time to arrive (3.3).
313 CVEs were added to KEV in : 130 within a week of publication, 54 more than a year after, 8 before it.
Listings keep arriving for years, so a recent cohort's share is not final. Time to listing is not time to first exploitation.
Within of publication, 0.28% of Q1 2026's CVEs were in KEV, against 0.52% of Q1 2022's.
Each quarter is measured over the same 180 days after publication, so older CVEs' extra time doesn't count. Hatched quarters haven't had 180 days yet.
The same 48,150 CVEs from 2025: 77.7% have one CVSS score; 197 are in KEV, 22 rated Low or Medium; EPSS gives 752 a probability of or more.
Severity, documented exploitation and forecast answer different questions. EPSS is the 12 November 2026 forecast for the next 30 days4; a missing score is unknown, never zero.
Same cohort as 3.2: CVEs published in 2025
What this cannot tell you
- Breaches that start another way. Exploitation was the top initial access vector in Verizon's 2026 data, at 31% of breaches with a known vector; most began otherwise.7
- Flaws without a CVE: in-house code, silent hosted-service fixes, anything undisclosed.
- Exploitation outside KEV.
- Why publication is rising. More discovery, more reporting and more assigners look the same in this data.
- Severity trends. NVD scored 82.7% of 2020 CVEs and 8.2% of 2026's.3
- Victims, losses, or whether we are more secure.
Sources
- CVE List v5, CVE Program · deltaLog@2026-11-13T09:28:04.236Z · github.com/CVEProject/cvelistV5
- CISA, Known Exploited Vulnerabilities catalog 2026.11.10 · cisa.gov/known-exploited-vulnerabilities
- NIST, National Vulnerability Database feeds · modified@2026-11-13T01:00:03.7699315 · nvd.nist.gov
- FIRST, EPSS v2026.06.15, scored 12 November 2026 · first.org/epss
- CVE Program, CNA Operational Rules v4.0, §4.2 · cve.org
- Linux kernel, CVE assignment process · kernel.org
- Verizon, 2026 Data Breach Investigations Report, executive summary · verizon.com
All dates UTC. Definitions, checks and downloads: Method.